Practical Multi-Source Multi-Client Searchable Encryption With Forward Privacy: Refined Security Notion and New Constructions

A hybrid scheme for multicast authentication over lossy networks

A secure and efficient AKE scheme for IoT devices using PUF and cancellable biometrics

With the application of the Internet of Things (IoT) and cloud computing, the eHealthcare industry has developed markedly, attracting many patients to seek medical treatment in an eHealthcare system. However, for patients who first register in the system, due to lack of experience, an important aspect is to choose appropriate medical services. Considering the sensitivity of health care data and the semi-honest nature of the cloud server, it is a good solution to use searchable encryption (SE) to obtain some historical electronic medical records (EMRs) that are consistent with the patient's symptom keyword combination and have high service scores for reference. However, existing SE schemes still have issues meeting the requirements of the eHealthcare system for flexible authorization and revocation, efficiency, and forward privacy. To resolve these issues, we propose two efficient and privacy-preserving electronic medical records query schemes with forward privacy in a multiuser setting (EPPFM). First, we present the basic scheme EPPFM-I to achieve a multiuser multikeyword exact match query under linear search complexity. In EPPFM-I, we also use the pseudorandom function (PRF) to perform the function of forward privacy. Then, we use a bucket structure to construct the improved scheme EPPFM-II, which has a faster-than-linear search complexity. Finally, we use detailed security analysis and extensive simulations to show the security and efficiency of the proposed schemes, respectively.

The advances in sensing capabilities of smartphones give rise to a variety of mobile participatory sensing applications that collect users' personal data. Because of the existence of both sensitive, private personal data, and untrusted aggregator, serious privacy concerns on users arise. Currently, existing privacy preserving data collection methods either require bidirectional communications between an untrusted aggregator and mobile users in every aggregation period, or have high computation or communication overhead. To address these problems, we propose an efficient data aggregation approach by which an untrusted aggregator in mobile sensing can collect the statistics over the data contributed by multiple mobile users, while supporting privacy preservation of each user and data integrity verification. In this approach, information hiding and homomorphic encryption are applied to guarantee the data privacy of mobile users. In detail, a breadth-first search tree is first constructed at the initial phase among the mobile users, and then the original datum of each user is perturbed among its neighbors in ciphertext space by using information hiding and homomorphic encryption. The evaluations of our approach show that our protocol requires lower communication and computation overhead and thus more feasible for the computation constrained mobile devices. Copyright © 2016 John Wiley & Sons, Ltd.

When the Wireless Sensor Network (WSN) is combined with the Internet of Things (IoT), it can be employed in a wide range of applications, such as agriculture, industry 4.0, health care, smart homes, among others. Accessing the big data generated by these applications in Cloud Servers (CSs), requires higher levels of authenticity and confidentiality during communication conducted through the Internet. Signcryption is one of the most promising approaches nowadays for overcoming such obstacles, due to its combined nature, i.e., signature and encryption. A number of researchers have developed schemes to address issues related to access control in the IoT literature, however, the majority of these schemes are based on homogeneous nature. This will be neither adequate nor practical for heterogeneous IoT environments. In addition, these schemes are based on bilinear pairing and elliptic curve cryptography, which further requires additional processing time and more communication overheads that is inappropriate for real-time communication. Consequently, this paper aims to solve the above-discussed issues, we proposed an access control scheme for IoT environments using heterogeneous signcryption scheme with the efficiency and security hardiness of hyperelliptic curve. Besides the security services such as replay attack prevention, confidentiality, integrity, unforgeability, non-repudiations, and forward secrecy, the proposed scheme has very low computational and communication costs, when it is compared to existing schemes. This is primarily because of hyperelliptic curve lighter nature of key and other parameters. The AVISPA tool is used to simulate the security requirements of our proposed scheme and the results were under two backbends (Constraint Logic-based Attack Searcher (CL-b-AtSER) and On-the-Fly Model Checker (ON-t-FL-MCR)) proved to be SAFE when the presented scheme is coded in HLPSL language. This scheme was proven to be capable of preventing a variety of attacks, including confidentiality, integrity, unforgeability, non-repudiation, forward secrecy, and replay attacks.

The increasing integration of Internet of Things (IoT) devices in Wireless Local Area Networks (WLANs) necessitates robust and efficient authentication mechanisms. While existing IoT authentication protocols address certain security concerns, they often fail to provide comprehensive protection against threats such as perfect forward secrecy violations, insider attacks, and key compromise impersonation, or impose significant computational and communication overhead on resource-constrained IoT systems. This paper presents a novel Extensible Authentication Protocol (EAP) based scheme for IoT-WLAN environments that addresses these security challenges while maintaining cost-effectiveness. Our approach utilizes elliptic curve cryptography and incorporates advanced features including perfect forward secrecy, strong identity protection, and explicit key confirmation. We provide a thorough security analysis using informal heuristics, formal methods (Random Oracle Model and BAN Logic), and automated verification with ProVerif. Performance evaluations demonstrate that our protocol achieves lower communication, storage, and computational costs compared to state-of-the-art solutions, with an average 79.6% reduction in computation time. A detailed comparison with existing schemes highlights the efficiency and enhanced security features of our proposed authentication mechanism for IoT-WLAN deployments.

EASBF: An efficient authentication scheme over blockchain for fog computing-enabled internet of vehicles

Secured lightweight authentication for 6LoWPANs in machine-to-machine communications

Recently, in 2013, Wu et al. proposed an efficient adaptable and scalable group access control scheme (GAC) for managing wireless sensor networks and they claimed that their proposed GAC approach provides the forward secrecy and backward secrecy, and it also prevents the man-in-the-middle attack. However, in this paper, we revisit Wu et al.'s scheme and show that Wu et al.'s scheme fails to provide the forward and backward secrecy to the group access key (GAK), and also their scheme does not prevent the man-in-the-middle attack and it does not provide the mutual authentication between a node and the task manager. Moreover, in Wu et al.'s scheme, all the past GAKs used by a node can be revealed to an adversary when that node is compromised. We then aim to propose a novel group access control mechanism to withstand the security weaknesses found in Wu et al.'s scheme while retaining the original merits of their scheme. Through the rigorous informal security analysis and the formal security analysis using the widely-accepted Burrows---Abadi---Needham logic, we show that our scheme is secure against various known attacks including the attacks found in Wu et al.'s scheme. Moreover, in our scheme, the vulnerability of the GAKs used by a node is limited and bounded to the last GAK update protocol interval when that node is compromised by an adversary. Our scheme provides efficient dynamic properties such as joining and leaving of a node from a group along with high security and the required desirable features as compared to Wu et al.'s scheme, and as a result, our scheme is very suitable for the practical applications.

The continued development of cloud computing requires technologies that protect users’ privacy even from the cloud service providers themselves. Searchable encryption is one such kind of technology that allows users to perform keyword search queries directly over encrypted documents stored on a remote server. Multi-user searchable encryption enables a data owner to allow multiple users to search over her encrypted document collection. For many applications, it is important to limit what an adversarial service provider can infer about the encrypted documents, even if it colludes with some of the users. Clearly, it can learn the content of documents shared with this subset of “corrupted” users, however, it is important to ensure that this collusion does not reveal information about parts of the dataset that are only shared with the remaining “uncorrupted” users, e.g., via cross-user leakage. In this work, we propose three novel schemes for this setting that achieve different trade-offs between performance and leakage. Compared to previous constructions, our first two schemes are the first ones to achieve asymptotically optimal search time. Our third scheme achieves minimal user storage and forward privacy with respect to document sharing, but slightly slower search performance. We formally prove the security of our schemes under reasonable assumptions. Moreover, we implement and evaluate their performance both on a single machine and over WAN. Our experimental results are encouraging, e.g., the search computation time is in the order of a few milliseconds.

The agriculture is the backbone of economic system, and it plays an essential part in the survival of a nation’s prosperity. In addition to providing raw materials and food, it also offers numerous employment opportunities. Consequently, agriculture necessitates modern technology to increase productivity. In these circumstances, Wireless Sensor Networks (WSNs) are used to detect climatic parameters like light, humidity, carbon dioxide, acidity, soil moisture, and temperature in an agricultural field. However, the research that is being done at the moment is unable to circumvent the issue that safety and effectiveness cannot coexist. Several studies employ time-consuming cryptographic security structures, whereas the majority of lightweight systems are designed without reviewing certain security aspects like resistance to ephemeral secret leakage (ESL) attacks, perfect forward secrecy, and so on. According to our opinion, this issue may be overcome through the use of lightweight cryptographic primitives, paying particular attention to protocol weaknesses, and keeping in mind the ever-changing security needs of individuals. We present an extensive lightweight three-factor authentication protocol with diverse security criteria, along with the adaptive privacy preservation, that is suited for user-friendly situation in the WSN enviroment. This is accomplished by removing all extraneous cryptographic structures. It has been illustrated that proposed protocol is much better in terms of the privacy and security aspects via the usage of security aspects, proof of the real-or-random (ROR) model, protocols of internet security, and applications that are subjected to experimental validation utilizing automated validation. and comparison with other protocols’ security aspects. The performance analysis shows how superior our proposed protocol is to other competing protocols in terms of communication and computational overheads, with respective efficiencies of 53% and 39%. Moreover, using the ROR model reveals that this study has benefits in performance compared with other competing research.

Smartphones have rapidly become ubiquitous with more than five billion users worldwide. Equipped with advanced sensors such as GPS, cameras, and microphones, they generate large amounts of diverse data. Much of this data, including locations, call logs, images, and online activities, is private. A suitable model training architecture is required to enhance usability through intelligent applications while preserving data privacy and security. In this paper, we develop a communication-efficient federated learning (CEFEEL) framework for smartphone personal assistant applications to protect data privacy and maintain user experience with low communication and computational overhead. The proposed framework identifies parameters that have converged early in the training phase and hence can be frozen or communicated intermittently, reducing communication overhead without compromising model accuracy. Extensive experiments demonstrate the robustness of our approach against unbalanced and non-IID data distributions. The experiments show that our developed framework, named FedFreeze and FedFreeze+ techniques, outperforms state-of-the-art FL algorithms like FedAvg in reducing communication and computational costs, preserving privacy, and maintaining training efficiency with comparable accuracy.

In this paper, we propose two decentralized Electric Vehicle (EV) charge scheduling schemes for shaping the load curve of residential communities connected to the electric grid. The first scheme is designed for Coordinated Valley-Filling (C-VF) of the load curve via only EV charging. The second scheme is designed for Coordinated Valley-Filling and Peak-Shaving (C-VF-PS) of the load curve via both EV charging and discharging. In both schemes, a set of grid-connected EVs referred to as an `EV Group' (EVG) coordinates their charge (and discharge) schedules by means of an iterative routine. Specifically, at each iteration of the respective routine, each EV in the EVG updates its charge (and discharge) schedule using a water-filling based algorithm that is specifically tailored for load curve shaping. To accommodate heterogeneous EV arrival times, which are often non-deterministic, each of C-VF and C-VF-PS is implemented in two methods, which differ in the way the EVG is formed. The first method requires all the grid-connected EVs to reschedule at designated time intervals, whereas the second method requires each EV to schedule only once, yielding lower computation and communication overheads. Numerical simulation results confirm that, compared to uncoordinated EV charging, C-VF and C-VF-PS reduce the load variance (flattens the load curve) by 47% and 65%, respectively. Furthermore, Method 2 is shown to be more effective than Method 1, in terms of computation and communication overheads.

In the RFID (Radio Frequency Identification) system, a tag with a unique ID is attached to an object and a reader can recognize the object by identifying the attached tag. With this identified tag ID, the reader can then retrieve the related information of the object from the backend server database. Due to the nature of RF signals, the communication between the reader and tags is vulnerable to attacks, leading to privacy and security weakness. Typical attacks include the forged-tag, forged-server, man-in-the-middle (MitM), tracking, replay, forward secrecy and DoS attacks. Due to the extremely small memory and very limited computation power of tags, some security schemes, like Chien and Chen's scheme, Chen and Deng's scheme, have been proposed to resist these attacks by using ultra lightweight operations on tags, such as the random number generation (RNG), the pseudo random number generator (PRNG), the cyclic redundancy check (CRC), and the exclusive-or (XOR) operator. These schemes still have some flaws, though. In this article, we show two mutual authentication schemes using only ultra lightweight operations conforming to the EPC global Class 1 Generation 2 (EPC C1G2) standard to resist aforementioned attacks and reduce the communication and/or computation overheads. We show comparisons of the two schemes and other related ones, and also show some research directions on designing good RFID reader-tag mutual authentication schemes.

The exponential growth of data storage and sharing in cloud demands an efficient access control mechanism for flexible data sharing. Attribute-Based Encryption (ABE) is a promising cryptographic solution to share data among users in the cloud. But it suffers from user revocation, attribute revocation, forward secrecy and backward secrecy issues. Communication and computation overhead is more due to the linear variation in the size of ciphertext and the secret key with respect to the number of attributes. In this paper, we investigate an on-demand access control for flexible sharing of secure data among randomly selected users. It is a tunable access control mechanism for the flexible sharing of ciphertext classes in the cloud. It delegates the decryption rights of any set of ciphertext classes among the users only if their attributes are satisfied with the access policy associated with ciphertext and if they should possess a compact key corresponding to the intended set of ciphertext classes. It produces a constant size ciphertext and a compact secret key to efficiently utilize the storage space and reduce the communication cost. The compact key aggregates the power of secret keys used to encrypt the outsourced data. This method flexibly shares the ciphertext classes among the randomly selected users with a specific set of attributes. All other ciphertext classes outside the set remain confidential. It allows dynamic data updates by verifying the data manipulation privilege of users with the help of claim policy. The proposed scheme provides access control of varying granularity, at user-level, at file-level, and attribute-level. Granularity levels can be chosen based on applications and user demands. Hence, it is a multi-level, tunable access control over the shared data. It is very useful for secure data storage. This scheme tackles user revocation and attribute revocation problems so that, it allows the data owner to revoke a specific user or a group of users. It prevents forward and backward secrecy issues.